🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.security.misc
Article #346

Re: Hiding Processes from ps -ax

#346
From: Steven Geyer
Date: Sat, 12 Sep 1992 13:49
36 lines
2167 bytes
>flaps@dgp.toronto.edu (Alan J Rosenthal) writes:
>>avalon@coombs.anu.edu.au (Darren Reed) writes:
>>Some people reported that "ps" showed "rn ut".
>
>I never saw those articles; on what system does it do this??!??!?  That is, if
>you zero out the rest of the name as my article said.  This would be extremely
>bizarre behaviour and I'm quite sceptical that it exists.
>
>>Here, it shows "rn (a.out)".
>>eg, I commonly have this:
>>18570 p8   I     0:01 -tcsh (tcsh)
>
>This is not the same situation.  Did my program actually show "rn (a.out)" or
>are you extrapolating?  On what OS?  There is a kludge in ps for when the
>argv[0] begins with a minus sign.  On SunOS 4.1.1 at least, it also seems to be
>triggered by having a completely empty name, as you create later.  Neither of
>these are methods I suggested because neither of them achieves the desired
>results.

How about... the minus sign means that it is a login shell.

>>However, if you can get the pid of a process then you can also
>>get the inode number of it too
>
>Processes don't have inode numbers.  Files have inode numbers.

One can still dump an core image of the process and rummage through to
find out who and what was happening.  Still not safe for a hacker.

Well Jay, it looks like we are out of luck (or not! ... depending on
which side of the line you reside ;-)

-- 
Steven A. Geyer <geyer@is.morgan.com> // if (get_standard_disclaimer())
UNIX IS Dept.                        //           USE_IT(); else
Morgan Stanley & Co., Inc.          // it_is_only_my_unforced_opinion();
Technical Details
Message-ID: <1992Sep12.094950@is.morgan.com>
Path: arc1-ca.pugleaf.net!sparky!uunet!s5!is1.is.morgan.com!is.morgan.com!geyer
References: <sxjcb-040992091012@sxjcb.uacn.alaska.edu> <1992Sep4.172142.4750@jarvis.csri.toronto.edu> <avalon.715879172@coombs> <GAY.92Sep10141255@moebius.loria.fr> <1992Sep11.004815.23118@jarvis.csri.toronto.edu>

Show Full Headers
Complete Article Headers
Newsgroups: comp.security.misc
Path: arc1-ca.pugleaf.net!sparky!uunet!s5!is1.is.morgan.com!is.morgan.com!geyer
From: geyer@is.morgan.com (Steven Geyer)
Subject: Re: Hiding Processes from ps -ax
Message-ID: <1992Sep12.094950@is.morgan.com>
Sender: news@is.morgan.com
Nntp-Posting-Host: alicia
Organization: Morgan Stanley
References: <sxjcb-040992091012@sxjcb.uacn.alaska.edu> <1992Sep4.172142.4750@jarvis.csri.toronto.edu> <avalon.715879172@coombs> <GAY.92Sep10141255@moebius.loria.fr> <1992Sep11.004815.23118@jarvis.csri.toronto.edu>
Date: Sat, 12 Sep 1992 13:49:50 GMT
Lines: 36